@promptowl/contextnest-community 1.14.0 → 1.16.1

package/CONFIGURATION.md

@@ -73,6 +73,7 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `TELEMETRY_INTERVAL_MS` | `3600000` (1 hour) | How often buffered telemetry is flushed to PromptOwl. |
 | `TRACE_RETENTION_DAYS` | `14` | Activity-trace retention window in days (the `api_events` rows behind `GET /admin/trace` and `GET /nests/:id/trace`). Rows older than this are pruned opportunistically (every ~500 inserts). `0` = keep forever (pruning is skipped entirely). Capped at `3650`; invalid/negative values fall back to `14`. Also editable from Settings → Advanced. |
 | `CORS_ORIGINS` | `*` in open mode; `http://localhost:5173,http://localhost:3838` in key mode | Comma-separated allowlist. Set to `*` to allow any origin (**only** safe in open mode — in key mode with Bearer tokens this enables CSRF). |
+| `FRAME_ANCESTORS` | `'self'` | Which origins may embed this server in an iframe, sent as CSP `frame-ancestors`. The default lets nothing but this origin frame the UI, which blocks clickjacking. Deployments that are meant to be embedded list the embedding origin — e.g. the PromptOwl Data Room iframes ContextNest, so that install sets `FRAME_ANCESTORS="https://app.promptowl.ai"`. Comma-separated; `'self'` is always included; `*` allows any site and disables the protection. Note the embedding page must be **same-site** (a sibling subdomain) for the session cookie to survive inside the frame — a genuinely cross-domain embed will render the login page no matter what this is set to. |
 | `MAX_BODY_BYTES` | `10485760` (10 MB) | Reject requests whose `Content-Length` exceeds this. Prevents giant-payload DoS. The asset-upload route (`POST /nests/:id/assets`) is exempt up to the video cap below. |
 | `VIDEO_MAX_MB` | `30` | Max size (in MB) of a video uploaded into a doc. Default `30` keeps it under Cloud Run's ~32 MiB HTTP/1 request-body limit, so an oversized video is rejected with a clear message instead of a bare `413` from the platform. Raise only where the deployment can actually accept larger request bodies (not behind Cloud Run, or on HTTP/2 / direct-to-bucket upload). Images are fixed at 10 MB. |
 | `LOGO_URL` | _(unset)_ | Custom logo shown in the UI header + login screen. Must start with `https://`, `http://`, or `data:image/` — other schemes (`file://`, relative, `javascript:`) are rejected with a warning and the bundled icon is used. |
@@ -279,6 +280,20 @@ On first connect the server creates its schema automatically (idempotent) — no
 manual migration step. There is no built-in SQLite→Postgres data migration; a new
 Postgres backend starts empty.
 
+### First-boot upgrade passes
+
+Some upgrades carry a one-shot data pass that runs at startup, before the server
+accepts requests, and records itself in `schema_migrations` so it never repeats.
+Two exist today: the `node_versions` backfill from `history.yaml`, and the
+version-chain repair added in 1.13 (re-anchors documents whose version chain was
+grafted by an older import, and moves inline patches into `v{N}.diff` files).
+
+Both walk every document in every nest, so on a large vault the **first** boot
+after upgrading can take noticeably longer than usual — reads of the on-disk
+vault, not database work, so an install on network/FUSE storage feels it most.
+Every subsequent boot skips the pass entirely. Progress and a per-pass summary
+are printed to the server log.
+
 > ⚠️ **Cloud Run durability — read this.** Cloud SQL persists only the *metadata
 > database*. The actual **document content and version history** live on the
 > filesystem under `$DATA_ROOT/nests/`, which on Cloud Run is **ephemeral** and is

package/dist/chunk-CLKZZZS2.js

@@ -0,0 +1,624 @@
+import {
+  buildTitleMap,
+  canEditWith,
+  canViewWith,
+  collabPermToRole,
+  docLink,
+  isSuperAdmin,
+  nestAllowsSelfApprove,
+  nestName,
+  primaryRole,
+  resolveNestPermission,
+  resolveTeamRolesForUser,
+  sendEmailToRecipient
+} from "./chunk-L7UCMGWZ.js";
+import {
+  ConflictError,
+  ValidationError
+} from "./chunk-GUNJTORH.js";
+import {
+  config,
+  getDb,
+  isEmailish
+} from "./chunk-JMJLNEXE.js";
+
+// src/governance/stewardship-service.ts
+import { v4 as uuid } from "uuid";
+async function assignSteward(data) {
+  const db = getDb();
+  const id = uuid();
+  await db.run(
+    `INSERT INTO stewards
+     (id, nest_id, scope, node_pattern, tag_name, user_email, user_id, role, assigned_by, is_active)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    [
+      id,
+      data.nestId,
+      data.scope,
+      data.nodePattern || null,
+      data.tagName || null,
+      data.userEmail,
+      data.userId || null,
+      data.role,
+      data.assignedBy,
+      data.isActive ? 1 : 0
+    ]
+  );
+  return { ...data, id };
+}
+async function removeSteward(id) {
+  const db = getDb();
+  await db.run("DELETE FROM stewards WHERE id = ?", [id]);
+}
+var VALID_STEWARD_ROLES = ["editor", "reviewer", "viewer"];
+async function updateSteward(id, update) {
+  const db = getDb();
+  const current = await db.get(
+    "SELECT * FROM stewards WHERE id = ? AND is_active = 1",
+    [id]
+  );
+  if (!current) {
+    throw new ValidationError("Steward not found");
+  }
+  const role = update.role ?? current.role;
+  if (!VALID_STEWARD_ROLES.includes(role)) {
+    throw new ValidationError(
+      `Invalid role "${role}" \u2014 must be editor, reviewer, or viewer.`
+    );
+  }
+  let scope = current.scope;
+  let nodePattern = current.node_pattern ?? null;
+  let tagName = current.tag_name ?? null;
+  if (update.scope) {
+    scope = update.scope;
+    nodePattern = null;
+    tagName = null;
+    switch (scope) {
+      case "document":
+        if (!update.documentId)
+          throw new ValidationError("documentId required for document scope");
+        nodePattern = update.documentId;
+        break;
+      case "tag":
+        if (!update.tagName)
+          throw new ValidationError("tagName required for tag scope");
+        tagName = update.tagName.trim().replace(/^#+/, "").toLowerCase();
+        break;
+      case "nest":
+        break;
+    }
+    const dup = await db.get(
+      `SELECT role FROM stewards
+         WHERE nest_id = ? AND is_active = 1 AND id != ? AND scope = ?
+           AND user_email = ?
+           AND COALESCE(node_pattern, '') = COALESCE(?, '')
+           AND COALESCE(tag_name, '') = COALESCE(?, '')`,
+      [current.nest_id, id, scope, current.user_email, nodePattern, tagName]
+    );
+    if (dup) {
+      const scopeLabel = scope === "document" ? `document "${nodePattern}"` : scope === "tag" ? `tag "#${tagName}"` : "this nest";
+      throw new ConflictError(
+        `"${current.user_email}" is already a steward of ${scopeLabel} with the "${dup.role}" role.`
+      );
+    }
+  }
+  await db.run(
+    "UPDATE stewards SET role = ?, scope = ?, node_pattern = ?, tag_name = ? WHERE id = ?",
+    [role, scope, nodePattern, tagName, id]
+  );
+  const row = await db.get("SELECT * FROM stewards WHERE id = ?", [id]);
+  return rowToSteward(row);
+}
+async function updateStewardRole(id, role) {
+  return updateSteward(id, { role });
+}
+async function getSteward(id) {
+  const db = getDb();
+  const row = await db.get("SELECT * FROM stewards WHERE id = ?", [id]);
+  return row ? rowToSteward(row) : null;
+}
+async function getStewardsForNest(nestId) {
+  const db = getDb();
+  const rows = await db.all(
+    "SELECT * FROM stewards WHERE nest_id = ? AND is_active = 1",
+    [nestId]
+  );
+  return enrichWithTitles(nestId, rows.map(rowToSteward));
+}
+async function getStewardsForScope(params) {
+  const db = getDb();
+  let sql = "SELECT * FROM stewards WHERE nest_id = ? AND is_active = 1";
+  const args = [params.nestId];
+  if (params.scope) {
+    sql += " AND scope = ?";
+    args.push(params.scope);
+  }
+  if (params.scopeTarget) {
+    sql += " AND (node_pattern = ? OR tag_name = ?)";
+    args.push(params.scopeTarget, params.scopeTarget);
+  }
+  return (await db.all(sql, args)).map(rowToSteward);
+}
+async function listStewards(params) {
+  const db = getDb();
+  let sql = "SELECT * FROM stewards WHERE nest_id = ? AND is_active = 1";
+  const args = [params.nestId];
+  if (params.scope) {
+    sql += " AND scope = ?";
+    args.push(params.scope);
+  }
+  if (params.search) {
+    sql += " AND (user_email LIKE ? OR tag_name LIKE ? OR node_pattern LIKE ?)";
+    const like = `%${params.search.toLowerCase()}%`;
+    args.push(like, like, like);
+  }
+  sql += " ORDER BY scope, COALESCE(node_pattern, tag_name, ''), user_email";
+  const stewards = (await db.all(sql, args)).map(rowToSteward);
+  return enrichWithTitles(params.nestId, stewards);
+}
+async function enrichWithTitles(nestId, stewards) {
+  if (!stewards.some((s) => s.scope === "document")) return stewards;
+  const titleByNodeId = await buildTitleMap(nestId);
+  for (const s of stewards) {
+    if (s.scope === "document" && s.nodePattern) {
+      s.nodeTitle = titleByNodeId.get(s.nodePattern);
+    }
+  }
+  return stewards;
+}
+async function createStewardRecord(params) {
+  if (params.users.length === 0) {
+    throw new Error("At least one user is required");
+  }
+  let nodePattern;
+  let tagName;
+  switch (params.scope) {
+    case "document":
+      if (!params.documentId) throw new Error("documentId required for document scope");
+      nodePattern = params.documentId;
+      break;
+    case "tag":
+      if (!params.tagName) throw new Error("tagName required for tag scope");
+      tagName = params.tagName.trim().replace(/^#+/, "").toLowerCase();
+      break;
+    case "nest":
+      break;
+  }
+  const db = getDb();
+  const results = [];
+  const actor = (params.assignedBy || "").trim().toLowerCase();
+  const ownerEmail = (await getNestOwnerEmail(params.nestId) || "").toLowerCase();
+  for (const user of params.users) {
+    const email = user.email.trim().toLowerCase();
+    if (!email) continue;
+    if (!isEmailish(email)) {
+      throw new ValidationError(`"${user.email}" is not a valid email address.`);
+    }
+    if (email === actor) {
+      throw new ValidationError(
+        "You already manage this nest, so you can't add yourself as a steward."
+      );
+    }
+    if (ownerEmail && email === ownerEmail) {
+      throw new ValidationError(
+        "The nest owner already has full access and doesn't need a steward role."
+      );
+    }
+    const existing = await db.get(
+      `SELECT * FROM stewards
+         WHERE nest_id = ? AND is_active = 1 AND scope = ? AND user_email = ?
+           AND COALESCE(node_pattern, '') = COALESCE(?, '')
+           AND COALESCE(tag_name, '') = COALESCE(?, '')`,
+      [
+        params.nestId,
+        params.scope,
+        email,
+        nodePattern ?? null,
+        tagName ?? null
+      ]
+    );
+    if (existing) {
+      const scopeLabel = params.scope === "document" ? `document "${nodePattern}"` : params.scope === "tag" ? `tag "#${tagName}"` : "this nest";
+      throw new ConflictError(
+        `"${email}" is already a steward of ${scopeLabel} with the "${existing.role}" role. Remove the existing assignment first to change the role.`
+      );
+    }
+    const userRow = await db.get(
+      "SELECT id FROM users WHERE email = ?",
+      [email]
+    );
+    let userId = userRow?.id;
+    if (!userId) {
+      const { hashPassword } = await import("./keys-73STFJJB.js");
+      userId = uuid();
+      await db.run(
+        "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
+        [userId, email, null, await hashPassword(uuid())]
+      );
+    }
+    const created = await assignSteward({
+      nestId: params.nestId,
+      scope: params.scope,
+      nodePattern,
+      tagName,
+      userEmail: email,
+      userId,
+      role: user.role ?? "reviewer",
+      assignedBy: params.assignedBy,
+      assignedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      isActive: true
+    });
+    results.push(created);
+  }
+  await db.run(
+    "UPDATE nests SET stewardship_enabled = 1 WHERE id = ? AND stewardship_enabled = 0",
+    [params.nestId]
+  );
+  if (results.length > 0) {
+    let scopeLabel;
+    if (params.scope === "document") {
+      const titles = await buildTitleMap(params.nestId);
+      const docTitle = titles.get(nodePattern) || nodePattern;
+      const capitalized = docTitle.charAt(0).toUpperCase() + docTitle.slice(1);
+      scopeLabel = `"${capitalized}" document`;
+    } else if (params.scope === "tag") {
+      scopeLabel = `#${tagName}`;
+    } else {
+      scopeLabel = "the whole nest";
+    }
+    const shareNestName = await nestName(params.nestId);
+    const link = docLink(params.nestId, void 0, params.baseUrl);
+    for (const s of results) {
+      void sendEmailToRecipient(s.userEmail, {
+        status: "steward",
+        docTitle: shareNestName,
+        path: shareNestName,
+        permission: s.role,
+        scopeLabel,
+        by: params.assignedBy || void 0,
+        link
+      });
+    }
+  }
+  return results;
+}
+async function resolveStewardsForNode(nestId, nodeId) {
+  return (await resolve(nestId, nodeId)).stewards;
+}
+async function resolveStewardsWithFallback(nestId, nodeId) {
+  return resolve(nestId, nodeId);
+}
+async function resolve(nestId, nodeId) {
+  const db = getDb();
+  const rows = await db.all(
+    `
+      SELECT s.*, 1 AS priority, ('document: ' || s.node_pattern) AS match_source
+        FROM stewards s
+        WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'document'
+          AND s.node_pattern = ?
+      UNION ALL
+      SELECT s.*, 2 AS priority, ('tag: ' || s.tag_name) AS match_source
+        FROM stewards s
+        JOIN node_tag_index nt
+          ON nt.nest_id = s.nest_id
+         AND nt.tag_name = s.tag_name
+        WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'tag'
+          AND nt.node_id = ?
+      UNION ALL
+      SELECT s.*, 3 AS priority, 'nest-level steward' AS match_source
+        FROM stewards s
+        WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'nest'
+      ORDER BY priority ASC, user_email ASC
+      `,
+    [
+      nestId,
+      nodeId,
+      // document branch
+      nestId,
+      nodeId,
+      // tag branch
+      nestId
+      // nest branch
+    ]
+  );
+  const resolved = rows.map((row) => ({
+    steward: rowToSteward(row),
+    priority: row.priority,
+    source: row.match_source
+  }));
+  if (resolved.length > 0) {
+    return { stewards: resolved, fallbackToOwner: false };
+  }
+  const owner = await db.get(
+    `SELECT u.email FROM nests n
+       JOIN users u ON u.id = n.user_id
+       WHERE n.id = ?`,
+    [nestId]
+  );
+  return {
+    stewards: [],
+    fallbackToOwner: true,
+    ownerEmail: owner?.email
+  };
+}
+async function userIdForEmail(email) {
+  const db = getDb();
+  const row = await db.get(
+    "SELECT id FROM users WHERE LOWER(email) = LOWER(?)",
+    [email]
+  );
+  return row?.id;
+}
+async function getStewardRolesForUser(nestId, userEmail) {
+  const db = getDb();
+  const rows = await db.all(
+    "SELECT DISTINCT role FROM stewards WHERE nest_id = ? AND is_active = 1 AND LOWER(user_email) = LOWER(?)",
+    [nestId, userEmail]
+  );
+  return rows.map((r) => r.role);
+}
+async function getStewardsForUser(nestId, userEmail) {
+  const db = getDb();
+  const rows = await db.all(
+    "SELECT * FROM stewards WHERE nest_id = ? AND is_active = 1 AND LOWER(user_email) = LOWER(?)",
+    [nestId, userEmail]
+  );
+  return rows.map(rowToSteward);
+}
+async function getCollaboratorRole(nestId, userEmail) {
+  const userId = await userIdForEmail(userEmail);
+  if (!userId) return null;
+  const db = getDb();
+  const row = await db.get(
+    "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
+    [nestId, userId]
+  );
+  return row?.permission ?? null;
+}
+async function resolveGrantRoles(nestId, userEmail, userId) {
+  const [grantRaw, stewardRoles, teamRoles] = await Promise.all([
+    getCollaboratorRole(nestId, userEmail),
+    getStewardRolesForUser(nestId, userEmail),
+    resolveTeamRolesForUser(nestId, userId)
+  ]);
+  return [
+    ...new Set(
+      [collabPermToRole(grantRaw), ...stewardRoles, ...teamRoles].filter(
+        Boolean
+      )
+    )
+  ];
+}
+async function resolveUserRoles(nestId, userEmail, opts) {
+  const roles = /* @__PURE__ */ new Set();
+  if (isSuperAdmin(userEmail)) roles.add("admin");
+  const owner = await getNestOwnerEmail(nestId);
+  if (owner && owner.toLowerCase() === userEmail.toLowerCase()) {
+    roles.add("owner");
+  }
+  const userId = await userIdForEmail(userEmail);
+  if (userId) {
+    const collabRole = collabPermToRole(await resolveNestPermission(nestId, userId));
+    if (collabRole) roles.add(collabRole);
+    for (const role of await resolveTeamRolesForUser(nestId, userId)) {
+      roles.add(role);
+    }
+  }
+  const stewardRoles = opts?.nodeId ? (await resolveStewardsForNode(nestId, opts.nodeId)).filter(
+    (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase()
+  ).map((r) => r.steward.role) : await getStewardRolesForUser(nestId, userEmail);
+  for (const role of stewardRoles) roles.add(role);
+  return [...roles];
+}
+async function canManageStewards(nestId, userId) {
+  if (config.AUTH_MODE === "open") return true;
+  const perm = await resolveNestPermission(nestId, userId);
+  return perm === "owner" || perm === "admin";
+}
+async function canCreateInNest(nestId, userEmail) {
+  if (config.AUTH_MODE === "open" || isSuperAdmin(userEmail)) return true;
+  const userId = await userIdForEmail(userEmail);
+  if (userId) {
+    const perm = await resolveNestPermission(nestId, userId);
+    if (perm === "owner" || perm === "admin" || perm === "write") return true;
+  }
+  return (await getStewardsForUser(nestId, userEmail)).some(
+    (s) => s.role === "editor" && s.scope === "nest"
+  );
+}
+async function getNestOwnerEmail(nestId) {
+  const db = getDb();
+  const row = await db.get(
+    `SELECT u.email FROM nests n
+       JOIN users u ON u.id = n.user_id
+       WHERE n.id = ?`,
+    [nestId]
+  );
+  return row?.email ?? null;
+}
+async function canUserEdit(nestId, nodeId, userEmail) {
+  const roles = await resolveUserRoles(nestId, userEmail, { nodeId });
+  if (roles.includes("owner")) {
+    return { allowed: true, reason: "nest owner", role: "owner" };
+  }
+  if (isSuperAdmin(userEmail)) {
+    return { allowed: true, reason: "super admin", role: "super_admin" };
+  }
+  if (canEditWith(roles)) {
+    return {
+      allowed: true,
+      reason: "editor access (collaborator or steward)",
+      role: roles.includes("admin") ? "admin" : "editor"
+    };
+  }
+  return { allowed: false, reason: "no editor role on this node", role: null };
+}
+async function getCurrentVersionAuthor(nestId, nodeId) {
+  const db = getDb();
+  const row = await db.get(
+    `SELECT author FROM node_versions
+       WHERE nest_id = ? AND node_id = ?
+       ORDER BY version DESC LIMIT 1`,
+    [nestId, nodeId]
+  );
+  return row?.author ?? null;
+}
+async function getPendingReviewRequester(nestId, nodeId) {
+  const db = getDb();
+  const row = await db.get(
+    `SELECT requested_by FROM review_requests
+       WHERE nest_id = ? AND node_id = ? AND status = 'pending'
+       ORDER BY requested_at DESC LIMIT 1`,
+    [nestId, nodeId]
+  );
+  return row?.requested_by ?? null;
+}
+async function canUserApprove(nestId, nodeId, userEmail) {
+  const roles = await resolveUserRoles(nestId, userEmail, { nodeId });
+  const isOwner = roles.includes("owner");
+  const isSuper = isSuperAdmin(userEmail);
+  const allowSelf = await nestAllowsSelfApprove(nestId);
+  const hasStewardApprove = roles.includes("admin") || roles.includes("reviewer");
+  const actor = await getPendingReviewRequester(nestId, nodeId) ?? await getCurrentVersionAuthor(nestId, nodeId);
+  const isOwnSubmission = !!actor && actor.toLowerCase() === userEmail.toLowerCase();
+  if (hasStewardApprove) {
+    if (isOwnSubmission && !((isOwner || isSuper) && allowSelf)) {
+      return {
+        allowed: false,
+        reason: "You submitted this version for review, so you can't approve it yourself. Ask another reviewer to approve it (separation of duties).",
+        role: roles.includes("admin") ? "admin" : "reviewer"
+      };
+    }
+    return {
+      allowed: true,
+      reason: "reviewer access (collaborator or steward)",
+      role: roles.includes("admin") ? "admin" : "reviewer"
+    };
+  }
+  if (isOwner || isSuper) {
+    if (allowSelf) {
+      return {
+        allowed: true,
+        reason: isOwner ? "nest owner (self-approve enabled)" : "super admin",
+        role: isOwner ? "owner" : "super_admin"
+      };
+    }
+    return {
+      allowed: false,
+      reason: "Approvals go to assigned reviewers while self-approve is off. Enable self-approve in nest settings to approve directly (e.g. while seeding), or add a reviewer steward.",
+      role: isOwner ? "owner" : "super_admin"
+    };
+  }
+  const held = primaryRole(roles);
+  return {
+    allowed: false,
+    reason: held ? `You're a "${held}" on this document \u2014 only reviewers (or admins) can approve. Ask the nest owner to grant you the reviewer steward role.` : "You're not a steward on this document, so you can't approve it. Ask the nest owner to add you as a reviewer.",
+    role: held
+  };
+}
+async function canUserAccess(nestId, nodeId, userEmail) {
+  const roles = await resolveUserRoles(nestId, userEmail, { nodeId });
+  if (roles.includes("owner")) {
+    return { allowed: true, reason: "nest owner", role: "owner" };
+  }
+  if (isSuperAdmin(userEmail)) {
+    return { allowed: true, reason: "super admin", role: "super_admin" };
+  }
+  if (canViewWith(roles)) {
+    return {
+      allowed: true,
+      reason: "collaborator or steward access",
+      role: primaryRole(roles)
+    };
+  }
+  return { allowed: false, reason: "no collaborator or steward access", role: null };
+}
+async function syncFromConfig(nestId, config2) {
+  const db = getDb();
+  let count = 0;
+  await db.run(
+    "UPDATE stewards SET is_active = 0 WHERE nest_id = ?",
+    [nestId]
+  );
+  await db.run(
+    "UPDATE nests SET stewardship_enabled = 1 WHERE id = ?",
+    [nestId]
+  );
+  const addEntries = async (scope, entries, target) => {
+    for (const entry of entries) {
+      const user = await db.get(
+        "SELECT id FROM users WHERE email = ?",
+        [entry.email]
+      );
+      const rawRole = entry.role || "reviewer";
+      const role = rawRole === "admin" ? "reviewer" : rawRole;
+      await assignSteward({
+        nestId,
+        scope,
+        nodePattern: target?.nodePattern,
+        tagName: target?.tagName ? target.tagName.trim().replace(/^#+/, "").toLowerCase() : void 0,
+        userEmail: entry.email.toLowerCase(),
+        userId: user?.id,
+        role,
+        assignedBy: "config",
+        assignedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        isActive: true
+      });
+      count++;
+    }
+  };
+  if (config2.nest) {
+    await addEntries("nest", config2.nest);
+  }
+  if (config2.tags) {
+    for (const [tagName, entries] of Object.entries(config2.tags)) {
+      await addEntries("tag", entries, { tagName });
+    }
+  }
+  if (config2.documents) {
+    for (const [docPattern, entries] of Object.entries(config2.documents)) {
+      await addEntries("document", entries, { nodePattern: docPattern });
+    }
+  }
+  return count;
+}
+function rowToSteward(row) {
+  return {
+    id: row.id,
+    nestId: row.nest_id,
+    scope: row.scope,
+    nodePattern: row.node_pattern || void 0,
+    tagName: row.tag_name || void 0,
+    userEmail: row.user_email,
+    userId: row.user_id || void 0,
+    role: row.role,
+    assignedBy: row.assigned_by,
+    assignedAt: row.assigned_at,
+    isActive: !!row.is_active
+  };
+}
+
+export {
+  assignSteward,
+  removeSteward,
+  updateSteward,
+  updateStewardRole,
+  getSteward,
+  getStewardsForNest,
+  getStewardsForScope,
+  listStewards,
+  createStewardRecord,
+  resolveStewardsForNode,
+  resolveStewardsWithFallback,
+  getStewardRolesForUser,
+  getStewardsForUser,
+  getCollaboratorRole,
+  resolveGrantRoles,
+  resolveUserRoles,
+  canManageStewards,
+  canCreateInNest,
+  canUserEdit,
+  canUserApprove,
+  canUserAccess,
+  syncFromConfig
+};